Chainlit
Monthly
Unauthenticated remote directory deletion in Chainlit through 2.12.0 allows any network-accessible attacker to recursively destroy arbitrary filesystem directories reachable by the service process. The flaw resides in the socket.io session handler, which accepts a client-supplied sessionId without path sanitization and uses it directly in file system operations - permitting absolute and relative path traversal sequences to escape the intended upload directory. With a CVSS 4.0 score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N), exploitation requires no authentication or user interaction; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote code execution in Chainlit (2.4.0rc0 through 2.11.x) occurs when features.mcp.enabled is set to true, exposing the POST /mcp endpoint that accepts a user-controlled stdio command string. Because the allowlist only validates the executable name and passes arguments unchecked, an attacker can supply 'npx -y -c <payload>' to run arbitrary shell commands as the Chainlit process. Publicly available exploit code exists (working PoC from the reporting researchers and in the advisory); it is not listed in CISA KEV, and MCP has been disabled by default since v2.7.0, limiting the exposed population.
Session hijacking in Chainlit before 2.10.1 allows remote attackers with a valid victim sessionId to inherit an authenticated user's session via the WebSocket restore_existing_session path, which fails to verify session ownership. Successful exploitation grants the attacker the victim's roles and permissions, enabling unauthorized tool invocation and access to restricted data. No public exploit identified at time of analysis; EPSS is low (0.30%) and the issue is not listed in CISA KEV.
Server-side request forgery in Chainlit before 2.9.4 lets an authenticated user coerce the server into fetching an attacker-supplied URL, exposing internal network services and cloud metadata endpoints. The flaw lives in the /project/element update flow specifically when Chainlit is deployed with the SQLAlchemy data layer backend, whose element-creation logic issues an outbound HTTP GET against a user-controlled url field and persists the response through the configured storage provider. Publicly available exploit code exists (documented in Zafran's 'ChainLeak' research), though the flaw is not listed in CISA KEV and its EPSS probability is low at 0.04%.
Arbitrary file read in Chainlit versions prior to 2.9.4 lets an authenticated user disclose any file readable by the Chainlit service process by abusing the /project/element update flow with a user-controlled path. The server copies the referenced file into the attacker's session and returns a chainlitKey usable at /project/file/<chainlitKey> to exfiltrate contents. Publicly available exploit code exists (documented as part of the 'ChainLeak' research by Zafran), though EPSS is very low (0.03%) and it is not on CISA KEV.
Feedback endpoint authorization bypass in Chainlit through 2.12.0 allows authenticated users to modify or delete other users' feedback records by supplying arbitrary feedback identifiers to the PUT and DELETE API endpoints. The server performs no ownership verification before processing these operations (CWE-639), enabling silent corruption of human-rating datasets used in LLM evaluation and RLHF pipelines. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated remote directory deletion in Chainlit through 2.12.0 allows any network-accessible attacker to recursively destroy arbitrary filesystem directories reachable by the service process. The flaw resides in the socket.io session handler, which accepts a client-supplied sessionId without path sanitization and uses it directly in file system operations - permitting absolute and relative path traversal sequences to escape the intended upload directory. With a CVSS 4.0 score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N), exploitation requires no authentication or user interaction; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote code execution in Chainlit (2.4.0rc0 through 2.11.x) occurs when features.mcp.enabled is set to true, exposing the POST /mcp endpoint that accepts a user-controlled stdio command string. Because the allowlist only validates the executable name and passes arguments unchecked, an attacker can supply 'npx -y -c <payload>' to run arbitrary shell commands as the Chainlit process. Publicly available exploit code exists (working PoC from the reporting researchers and in the advisory); it is not listed in CISA KEV, and MCP has been disabled by default since v2.7.0, limiting the exposed population.
Session hijacking in Chainlit before 2.10.1 allows remote attackers with a valid victim sessionId to inherit an authenticated user's session via the WebSocket restore_existing_session path, which fails to verify session ownership. Successful exploitation grants the attacker the victim's roles and permissions, enabling unauthorized tool invocation and access to restricted data. No public exploit identified at time of analysis; EPSS is low (0.30%) and the issue is not listed in CISA KEV.
Server-side request forgery in Chainlit before 2.9.4 lets an authenticated user coerce the server into fetching an attacker-supplied URL, exposing internal network services and cloud metadata endpoints. The flaw lives in the /project/element update flow specifically when Chainlit is deployed with the SQLAlchemy data layer backend, whose element-creation logic issues an outbound HTTP GET against a user-controlled url field and persists the response through the configured storage provider. Publicly available exploit code exists (documented in Zafran's 'ChainLeak' research), though the flaw is not listed in CISA KEV and its EPSS probability is low at 0.04%.
Arbitrary file read in Chainlit versions prior to 2.9.4 lets an authenticated user disclose any file readable by the Chainlit service process by abusing the /project/element update flow with a user-controlled path. The server copies the referenced file into the attacker's session and returns a chainlitKey usable at /project/file/<chainlitKey> to exfiltrate contents. Publicly available exploit code exists (documented as part of the 'ChainLeak' research by Zafran), though EPSS is very low (0.03%) and it is not on CISA KEV.
Feedback endpoint authorization bypass in Chainlit through 2.12.0 allows authenticated users to modify or delete other users' feedback records by supplying arbitrary feedback identifiers to the PUT and DELETE API endpoints. The server performs no ownership verification before processing these operations (CWE-639), enabling silent corruption of human-rating datasets used in LLM evaluation and RLHF pipelines. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.